Keep loyalty points and gift card balances safe

Loyalty reward schemes are a regular feature of the eCommerce, travel and leisure landscape, with points accumulated based on repeated custom. Loyalty programs are as attractive to cybercriminals as they are to customers. Adversaries exploit loyalty schemes to purchase products or services to use or resell for profit.

Adversaries will typically use easily accessible data leaks in credential stuffing attacks, targeting businesses with loyalty point schemes. When they get a hit, they can takeover exposed accounts and steal any points accumulated by the customer.

Whilst credit card cracking garners lots of mainstream attention, gift card cracking is a less well-known financial attack with a low-risk, high-reward profile for criminals.

With the format of gift card codes known, automated bots can be programmed to brute force existing codes saved in the system. This can either run at high volumes or hide within typical traffic patterns to avoid detection in the long term.

If gift card codes are generated by a web-facing API, attackers can also exploit this to generate new codes automatically, often without the knowledge of the target business.

Although logging in and spending loyalty points, or inputting a gift card code are expected behaviors on web systems, there are telltale signs when these actions are undertaken by a bot.

Sophisticated attackers will attempt to disguise their nature through means such as CAPTCHA bypass, device fingerprint emulation or rate limiting. However, Netacea uses advanced machine learning models to analyze every single request across websites, mobile apps and APIs, comparing intent to expected behaviors and patterns to flag and block the fraudsters.